Mining flow early detection method based on knowledge distillation

Abstract

The invention discloses a mining flow early detection method based on knowledge distillation, and aims to solve the problems that feature extraction depends on expert knowledge and the real-time detection effect is poor in the mining flow detection process in the prior art. According to the method, the detection accuracy is improved by screening basic features of data packets, verifying optimal flow early-stage features, extracting flow features suitable for mining flow detection tasks and further extracting time sequence features in the flow early-stage features by using a knowledge distillation technology under the condition of not increasing model complexity. Through the method, the mining behavior can be rapidly and accurately detected at the initial stage of the session, and the method has the advantages of being high in real-time performance and high in accuracy.

Description

Technical Field

[0001] The present invention relates to the field of traffic analysis and network security technology, and in particular to an early detection method for mining traffic based on knowledge distillation. Background Art

[0003] The rampant mining behavior consumes a lot of energy, causes harm to the environment and health, and violates the concept of energy conservation, emission reduction and sustainable development. Therefore, timely detection and identification of mining behavior, and reasonable restrictions and policy supervision can effectively curb the energy consumption of virtual currency mining activities.

[0004] Detection methods for mining behavior can be roughly divided into two methods: host-based and network traffic-based. The host-based mining behavior model is mainly applied to terminal hosts. This method aims to extract the calls and operations of the host system as the main features to detect possible mining activities in the system. The host-based detection method can accurately identify whether there is mining behavior in the target host, but this method can only detect a single target host. When the number of hosts to be detected is large, it is difficult to deploy. The problem of detection tools needing maintenance and upgrades further increases the maintenance cost.

[0005] Mining behavior detection based on network traffic has the advantages of flexibility and easy deployment. However, due to the complexity of network traffic and communication protocols, related work still has the following problems:

[0006] 1) It is difficult to establish a complete fingerprint library for deep packet inspection methods. Traditional methods based on deep packet inspection match the plaintext of data packets with known mining protocol instructions to detect mining traffic, which requires frequent maintenance. However, there are many types of private protocols used for mining behavior, making it difficult to establish a complete fingerprint library. Traditional methods also require a lot of manual assistance in maintaining relevant databases. In addition, mining pools can bypass detection by simply changing protocol instructions.

[0007] 2) The construction of mining traffic statistical features relies on expert knowledge. The existing mining traffic feature construction usually relies on the professional knowledge of experts. Common mining traffic detection methods extract features such as packet interval features, packet size features, and packet rate features in the flow, or construct unique features to represent the characteristics of mining traffic. This type of feature extraction method has certain subjectivity and limitations. Different experts have different understandings and extraction methods of mining traffic features, resulting in different detection focuses, which may ultimately affect the fluctuation of actual detection results.

[0008] 3) Statistical traffic features lead to poor real-time detection results: Detection methods based on network traffic statistical features do not work well in real-time detection and have a high false alarm rate. Statistical features are usually based on complete triplet flows or quintuple flows. It is difficult to obtain complete flows in real-time detection, which seriously affects the accuracy of statistical features and reduces detection accuracy. Summary of the invention

[0009] The present invention proposes a method for early detection of mining traffic based on knowledge distillation to solve the above technical problems. The method aims to use as few early traffic data packets as possible to quickly and accurately detect mining traffic in the early stage of session establishment.

[0010] The technical solution adopted by the present invention is: extracting the early basic features of the traffic to make up for the shortcomings of statistical features, and using knowledge distillation technology to further extract the timing features in the early basic features to improve the detection accuracy without increasing the complexity of the model.

[0011] In order to achieve the above object, the present invention comprises the following steps:

[0012] 1) Early feature extraction method of flow:

[0013] Step S101: Traffic data collection and preprocessing: collect plaintext and encrypted mining traffic, as well as background traffic of normal network activities such as web browsing, online chatting, online meetings, etc. to construct a traffic data set D1, and perform packet-level preprocessing on the original traffic data set D1 to construct a traffic basic feature data set D2;

[0014] Step S102: Filter the basic features of the data packet; evaluate the importance of the basic features in the traffic basic feature data set D2 in the mining traffic detection task through three types of feature selection methods: filtering, wrapping and embedded, and filter out the basic features that are most suitable for the mining traffic detection task;

[0015] Step S103: verify the optimal early flow features; conduct multiple experiments on the early flow features at the first ten data packet levels on the classic machine learning algorithm, and select the early flow features with the best performance through the Wilcoxon signed rank test to construct the optimal early flow feature data set D3;

[0016] 2) Mining behavior detection model based on knowledge distillation:

[0017] Step S104: Construct a convolutional neural network traffic detection model based on knowledge distillation; pre-train the teacher model according to the optimal flow early feature dataset D3, use the feature map of the convolutional neural network and the output features of the timing model to construct a guidance function, optimize the parameters of the main loss function by introducing the guidance function, and adjust the guidance parameters to ensure the best performance of the model in mining traffic detection.

[0018] Furthermore, the step S101 is specifically as follows:

[0019] Step S201: Collect mining traffic, including plaintext mining traffic and encrypted mining traffic. The payload information of the plaintext mining traffic is not encrypted and can be directly read for detection, while the encrypted mining traffic is encrypted by TLS or SSL protocol.

[0020] Step S202: Collect background traffic, including batch web page access traffic generated by the automation tool selenium, as well as network chat and online meeting traffic generated by normal users, and combine with mining traffic to form a traffic data set D1;

[0021] Step S203: Preprocess the basic features at the packet level and select some basic features suitable for the traffic detection task. In the traffic data set D1, remove the MAC address, IP address, port, sequence number, confirmation number and other inapplicable features in the original information of the data packet, extract the remaining basic features of the data packet, and construct the traffic basic feature data set D2;

[0022] Furthermore, the step S102 is specifically as follows:

[0023] Step S301: The filtering feature selection method uses three statistical methods: variance difference, chi-square distribution, and correlation coefficient to evaluate the importance of basic features of the traffic basic feature data set D2.

[0024] Step S302: The wrapper feature selection method uses a recursive feature elimination method to perform feature selection in the SVM, LDA, and SGD models, and sorts the basic features of the traffic basic feature data set D2.

[0025] Step S303: The embedded feature selection method combines the AdaBoost algorithm of decision tree, random forest and integrated decision tree to calculate the importance of basic features of the traffic basic feature data set D2.

[0026] Step S304: According to the comprehensive ranking of the importance of the basic features in the mining traffic detection task in the nine methods, the basic features most suitable for mining traffic detection are selected.

[0027] Furthermore, step S103 is specifically as follows:

[0028] Step S401: Divide the original data according to five-tuples, observe and summarize the communication rules of mining traffic and background traffic, extract the payload length and packet direction of the early data packets of the flow, and the screened basic features, and construct the early features of the flow containing different numbers of data packets in turn.

[0029] Step S402: For the early flow features at the first ten packet levels, multiple experiments are conducted on five classic machine learning algorithms, namely RF, SVM, LDA, NB and KNN, and the model performance indicators are recorded.

[0030] Step S403: Use the Wilcoxon signed rank test to verify the performance difference of the early flow features at adjacent levels, select the best early flow features, and form the optimal early flow feature data set D3.

[0031] Furthermore, the step S104 is specifically as follows:

[0032] Step S501: Traffic packets divided into flows and arranged in sequence can be considered as a special case of time series data. LSTM or GRU can effectively capture the time series characteristics of mining traffic. Use the optimal flow early feature dataset D3 to pre-train the baseline model, and select the appropriate time series model and convolutional neural network as the teacher model and student model respectively;

[0033] Step S502: The feature graph in the convolutional neural network and the output features of the timing model can be expressed by batch size (b), number of channels (c), height (h), and width (w) respectively as follows:

[0034] O c ∈R (b×c×h×w)

[0035] O s ∈R (h×b(c×w))

[0036] The training methods of the two types of models are also different, resulting in differences in the output features of the convolutional layer and the time series model. In order to accurately calculate the distance metric between the two features, they are converted into two-dimensional data of the same size, specifically expressed as:

[0037] F c =Linear(O c ), F c ∈R (b×(c×h×w))

[0038] F s = reshape(O s ),F s ∈R (b×(c×h×w))

[0039] Among them, the Linear function is a learnable linear projection, which is implemented by 1×1 convolution. The 1×1 convolution performs a weighted summation of the channels at each position of the feature map and finally converts it into a single-channel output. The Linear function can effectively retain feature information and align the convolution with the time series output features. The reshape function converts the time series output into an image-like output and calculates the feature difference to form a guidance function:

[0040] L guide =||F c -F s || 2

[0041] Step S503: The main loss function generated by the training is generated by CNN completing the detection and classification task, and its time series output is obtained to guide the task. cls It represents the cross entropy loss function generated by CNN's autonomous learning of local features when performing detection and classification tasks, that is, the main loss function. The difference between the extracted local information features and the global information features is added to the main loss function, so that CNN can learn the temporal characteristics of the data when updating parameters. The final loss function in training consists of two parts: the main loss function and the guidance function of CNN:

[0042] L=L cls -β·L guide

[0043] Among them, the guidance parameter β is a hyperparameter set based on practical experience. The grid search algorithm is used to adjust the guidance parameter to ensure the best performance of the model in the mining traffic detection task.

[0044] Compared with the prior art, the present invention has the following advantages:

[0045] 1) The traffic feature extraction method proposed in the present invention can detect both plaintext mining traffic and encrypted mining traffic, is independent of the fingerprint library, and can effectively cope with the diversity of protocols, thereby improving the coverage and flexibility of detection;

[0046] 2) The invention of this paper only uses the original data of the four non-zero data packets in the early stage of the session, avoiding the dependence on statistical features, simplifying the data processing process, and making the early features have the basic characteristics and timing characteristics of the traffic, thereby enhancing the real-time and accuracy of the detection;

[0047] 3) Use knowledge distillation methods to further extract basic traffic characteristics and timing characteristics while reducing model complexity to achieve rapid detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1This is an overall flow chart of a method for early detection of mining traffic based on knowledge distillation of the present invention;

[0049] Figure 2 This is a flow chart of flow data collection and preprocessing of the present invention;

[0050] Figure 3 The basic feature flow chart of the present invention for screening data packets;

[0051] Figure 4 Flowchart of early characteristics of optimal flow verified for the present invention;

[0052] Figure 5 It is a curve diagram of the detection accuracy change of the early characteristics of the flow of the present invention;

[0053] Figure 6 A flow chart of a convolutional neural network traffic detection model based on knowledge distillation is constructed for the present invention; DETAILED DESCRIPTION

[0054] The following describes in detail a specific implementation of a method for early detection of mining traffic based on knowledge distillation of the present invention in conjunction with the accompanying drawings.

[0055] Figure 1 This is an overall flow chart of a method for early detection of mining traffic based on knowledge distillation of the present invention;

[0056] The present invention discloses a method for early detection of mining traffic based on knowledge distillation, comprising the following steps:

[0057] Step S101: Traffic data collection and preprocessing; collect plaintext and encrypted mining traffic, as well as background traffic of normal network activities such as web browsing, online chatting, online meetings, etc. to construct a traffic data set D1, and perform packet level preprocessing on the original traffic data set D1 to construct a traffic basic feature data set D2.

[0058] Figure 2 This is a flow chart of flow data collection and preprocessing of the present invention.

[0059] Specifically, it can be divided into the following steps:

[0060] Step S201: Collect mining traffic, including plaintext mining traffic and encrypted mining traffic. The payload information of the plaintext mining traffic is not encrypted and can be directly read for detection, while the encrypted mining traffic is encrypted by TLS or SSL protocol;

[0061] Step S202: collecting background traffic, including batch web page access traffic generated by the automation tool selenium, and network chat and online conference traffic generated by normal users, and combining it with mining traffic to form a traffic data set D1;

[0062] Step S203: Preprocess the basic features of the data packet level, remove the MAC address, IP address, port, sequence number, and confirmation number of the data packet in the traffic data set D1, extract the remaining basic features of the data packet, and construct the traffic basic feature data set D2

[0063] Specifically, the flow data information of the present invention is shown in Table 1.

[0064] Table 1 Flow data information

[0065]

[0066] Step S102: Filter the basic features of the data packet; evaluate the importance of the basic features in the traffic basic feature data set D2 in the mining traffic detection task through three types of feature selection methods: filtering, wrapping and embedded, and filter out the basic features that are most suitable for the mining traffic detection task

[0067] Figure 3 This is a flow chart of the basic feature of data packets screened by the present invention.

[0068] Specifically, it can be divided into the following steps:

[0069] Step S301: The filtering feature selection method uses three statistical methods: variance difference, chi-square distribution, and correlation coefficient to evaluate the importance of basic features of the traffic basic feature data set D2.

[0070] Specifically, the VarianceThreshold function in the scikit-learn library is used to measure the degree of discreteness of feature variance, and features are sorted according to the size of variance; the chi2 function in the scikit-learn library is used to use the chi-square test to evaluate the independence of features between two categories, and features are sorted according to the chi-square statistic between the features and the target variable; the pearsonr function in scipy is used to calculate the correlation coefficient between each feature and the target variable, and features are sorted according to feature correlation.

[0071] Step S302: The wrapper feature selection method uses a recursive feature elimination method to perform feature selection in the SVM, LDA, and SGD models, and sorts the basic features of the traffic basic feature data set D2.

[0072] Specifically, the RFE function in the scikit-learn library is used for feature selection, in which three classic linear machine learning models, SVM, LDA, and SGD, are nested, and the three models are output to rank the basic features of the data packets.

[0073] Step S303: The embedded feature selection method combines the AdaBoost algorithm of decision tree, random forest and integrated decision tree to calculate the importance of basic features of the traffic basic feature data set D2.

[0074] Specifically, the RFE function in the scikit-learn library is used for feature selection, in which three classic linear machine learning models, SVM, LDA, and SGD, are nested, and the three models are output to rank the basic features of the data packets.

[0075] Step S304: According to the comprehensive ranking of the importance of the basic features in the mining traffic detection task in the nine methods, the basic features most suitable for mining traffic detection are selected.

[0076] Specifically, taking the wrapping feature selection method based on feature recursive elimination as an example, the ranking of basic features is shown in Table 2.

[0077] Table 2 Basic feature ranking of feature recursive elimination method

[0078] Serial number SVM LDA SGD 1 Overall length Overall length Overall length 2 Flags Flags Flags 3 Header length window Header length 4 Survival time Survival time Survival time 5 Slice offset Differentiated Services Slice offset

[0079] The present invention selects the total length, survival time, flag, window and slice offset features of the data packet after comprehensively sorting the basic features.

[0080] Step S103: verify the optimal early flow features; conduct multiple experiments on the early flow features at the first ten data packet levels on the classic machine learning algorithm, and select the early flow features with the best performance through the Wilcoxon signed rank test to construct the optimal early flow feature data set D3;

[0081] Figure 4 This is a flow chart for verifying the optimal flow early characteristics of the present invention.

[0082] Specifically, it can be divided into the following steps:

[0083] Step S401: Divide the original data according to five-tuples, observe and summarize the communication rules of mining traffic and background traffic, extract the payload length and packet direction of the early data packets of the flow, and the screened basic features, and construct the early features of the flow containing different numbers of data packets in turn.

[0084] Step S402: For the early flow features at the first ten packet levels, multiple experiments are conducted on five classic machine learning algorithms, namely RF, SVM, LDA, NB and KNN, and the model performance indicators are recorded.

[0085] Step S403: Use the Wilcoxon signed rank test to verify the performance difference of the early flow features at adjacent levels, select the best early flow features, and form the optimal early flow feature data set D3.

[0086] Specifically, the detection accuracy of early features of each level of flow on five classic machine learning algorithms, RF, SVM, LDA, NB and KNN, is as follows: Figure 5 As shown in Table 3, as the number of packets contained in the early flow features continues to increase, the classification accuracy of each algorithm generally shows an upward trend. However, when the feature scale reaches a certain level, the detection accuracy tends to be stable. Taking the Wilcoxon signed rank test results of the early flow features at various levels on the RF algorithm as an example, as shown in Table 3, when the early flow features contain 5 packet features, the detection performance of the RF algorithm has not been significantly improved. Therefore, the optimal early flow feature dataset D3 consisting of the first 4 non-zero packets is constructed.

[0087] Table 3 RF algorithm Wilcoxon signed rank test results

[0088] P-value Significant difference 1—2 0.139 no 2—3 0.005 yes 3—4 0.009 yes 4—5 0.508 no 5—6 0.959 no 6—7 0.539 no 7—8 0.646 no 8—9 0.515 no 9—10 0.139 no

[0089] 2) Mining traffic detection model based on knowledge distillation:

[0090] Step S104: Construct a convolutional neural network detection model based on knowledge distillation; pre-train the teacher model based on the optimal flow early feature dataset D3, use the feature map of the convolutional neural network and the output features of the timing model to construct a guidance function, optimize the parameters of the main loss function by introducing the guidance function, and adjust the guidance parameters to ensure the best performance of the model in mining traffic detection.

[0091] Figure 6 A flow chart of a convolutional neural network traffic detection model based on knowledge distillation is constructed for the present invention.

[0092] Specifically, it can be divided into the following steps:

[0093] Step S501: pre-train the baseline model using the optimal flow early feature dataset D3, and select a suitable timing model and convolutional neural network as the teacher model and student model respectively;

[0094] Specifically, the baseline deep learning model is trained using verified early stream features, such as LeNet-5, ResNet, LSTM and GRU, etc., the best performing time series model is selected as the teacher model, and the best performing convolutional neural network model is selected as the student model. The present invention selects the LeNet-5 model as the guided student model and the pre-trained GRU as the teacher model.

[0095] Step S502: select the feature map of the convolutional neural network and the output feature of the time series model for alignment, calculate the feature difference between the two, and construct a guidance function;

[0096] Specifically, this example selects the feature map generated by the first convolution layer of the convolutional neural network as the guidance object. Specifically, it is a 144×3×7×7 matrix. The selected GRU model output feature is a 7×144×7 matrix. Both features are processed into a 144×49 matrix, and the Euclidean distance between the features is calculated to form a guidance function.

[0097] Step S503: Optimize the parameters of the main loss function using the guidance function of step S502, and adjust the guidance parameters using the grid search algorithm to ensure the best performance of the knowledge distillation method in mining traffic detection.

[0098] Specifically, the present invention uses a grid search method to traverse all possible hyperparameter combinations in the range (0, 2, 0.5) set, and trains a model for each hyperparameter combination. The main training function of the model is set to CrossEntropyLoss(), in which a guidance function is added to learn the distance difference between the feature map and the time series output. The parameters are updated by the back propagation algorithm to minimize the combined loss function. The performance of each hyperparameter model is evaluated on the validation set, and the best guidance hyperparameter is selected according to the accuracy and F1 score of the model. The experimental results are shown in Table 5. When the value of the hyperparameter is 0, the detection performance of the student model is the same as that of the baseline model. When the value of the hyperparameter is 0.5, the performance of the student model is the best.

[0099] Table 5 Hyperparameter β corresponding to model performance

[0100] β Accuracy F1 value 0.0 98.90％ 0.9892 0.5 99.44％ 0.9946 1.0 99.07％ 0.9906 1.5 98.88％ 0.9990 2.0 97.94％ 0.9801

Claims

1. A mining traffic early detection method based on knowledge distillation, characterized in that: The following steps are involved: 1) Early feature extraction method of flow: Step S101: flow data collection and preprocessing; Collect plaintext and encrypted mining traffic, as well as normal network activities such as web browsing, online chatting, and online meeting background traffic to build a traffic dataset D1, and perform packet-level preprocessing on the original traffic dataset D1 to build a traffic basic feature dataset D2; Step S102: Filter the basic features of the data packet; evaluate the importance of the basic features in the traffic basic feature data set D2 in the mining traffic detection task through three types of feature selection methods: filtering, wrapping and embedded, and filter out the basic features that are most suitable for the mining traffic detection task; Step S103: verify the optimal early flow features; conduct multiple experiments on the early flow features at the first ten data packet levels on the classic machine learning algorithm, and select the early flow features with the best performance through the Wilcoxon signed rank test to construct the optimal early flow feature data set D3; 2) Mining behavior detection model based on knowledge distillation: Step S104: Construct a convolutional neural network traffic detection model based on knowledge distillation; pre-train the teacher model according to the optimal flow early feature dataset D3, use the feature map of the convolutional neural network and the output features of the timing model to construct a guidance function, optimize the parameters of the main loss function by introducing the guidance function, and adjust the guidance parameters to ensure the best performance of the model in mining traffic detection.

2. The method according to claim 1, characterized in that The step S101 is specifically as follows: Step S201: Collect mining traffic, including plaintext mining traffic and encrypted mining traffic. The payload information of plaintext mining traffic is not encrypted and can be directly read for detection, while the encrypted mining traffic is encrypted by TLS or SSL protocol, and the payload information cannot be directly read; Step S202: collecting background traffic, including batch web page access traffic generated by the automation tool selenium, and network chat and online conference traffic generated by normal users, and combining it with mining traffic to form a traffic data set D1; Step S203: pre-process the basic features at the data packet level, remove the MAC address, IP address, port, sequence number, and confirmation number of the data packet in the traffic data set D1, extract the remaining basic features of the data packet, and construct the traffic basic feature data set D2.

3. The method according to claim 1, characterized in that The step S102 is specifically as follows: Step S301: The filtering feature selection method uses three statistical methods, namely, variance difference, chi-square distribution, and correlation coefficient, to evaluate the importance of the basic features of the traffic basic feature data set D2; Step S302: The wrapper feature selection method uses a recursive feature elimination method to perform feature selection in the SVM, LDA, and SGD models to sort the basic features of the traffic basic feature data set D2; Step S303: The embedded feature selection method combines the AdaBoost algorithm of decision tree, random forest and integrated decision tree to calculate the importance of basic features of the traffic basic feature data set D2; Step S304: According to the comprehensive ranking of the importance of the basic features in the mining traffic detection task in the nine methods, the basic features most suitable for mining traffic detection are selected.

4. The method according to claim 1, characterized in that: The step S103 is specifically as follows: Step S401: Divide the original data according to the five-tuple, observe and summarize the communication rules of mining traffic and background traffic, extract the payload length and packet direction of the early data packets of the flow, and the selected basic features, and sequentially construct the early features of the flow containing different numbers of data packets; Step S402: for the early flow features at the first ten data packets level, multiple experiments are conducted on five classic machine learning algorithms, namely RF, SVM, LDA, NB and KNN, and the model performance indicators are recorded; Step S403: Use the Wilcoxon signed rank test to verify the performance difference of the early flow features at adjacent levels, select the best early flow features, and form the optimal early flow feature data set D3.

5. The method according to claim 1, characterized in that: The step S104 is specifically as follows: Step S501: pre-train the baseline model using the optimal flow early feature dataset D3, and select a suitable timing model and convolutional neural network as the teacher model and student model respectively; Step S502: select the feature map of the convolutional neural network and the output feature of the time series model for alignment, calculate the feature difference between the two, and construct a guidance function; Step S503: Optimize the parameters of the main loss function using the guidance function of step S502, and adjust the guidance parameters using the grid search algorithm to ensure the best performance of the knowledge distillation method in mining traffic detection.

6. The method according to claim 2, characterized in that The step S201: collects mining traffic, including plaintext mining traffic and encrypted mining traffic. The payload information of the plaintext mining traffic is not encrypted and can be directly read for detection, while the encrypted mining traffic is encrypted by TLS or SSL protocol, and the payload information cannot be directly read.

7. The method according to claim 2, characterized in that: The step S203: pre-processes basic features at the data packet level, selects some basic features suitable for the traffic detection task, removes inapplicable features such as MAC address, IP address, port, sequence number, confirmation number, etc. in the original information of the data packet in the traffic data set D1, extracts the remaining basic features of the data packet, and constructs the traffic basic feature data set D2.

8. The method according to claim 5, characterized in that The step S501: traffic data packets divided into flows and arranged in sequence are considered to be a special case of time series data. LSTM or GRU can effectively capture the timing characteristics of mining traffic. The baseline model is pre-trained using the optimal flow early feature dataset D3, and a suitable timing model and convolutional neural network are selected as the teacher model and student model respectively.

9. The method according to claim 5, characterized in that In step S502, the feature graph in the convolutional neural network and the output features of the time series model can be respectively expressed by batch size (b), number of channels (c), height (h), and width (w): THE c ∈R (b×c×h×w) THE s ∈R (h×b(c×w)) The training methods of the two types of models are also different, resulting in differences in the output features of the convolutional layer and the time series model. In order to accurately calculate the distance metric between the two features, they are converted into two-dimensional data of the same size, which is specifically expressed as: F c =Linear(O c ),F c ∈R (b×(c×h×w)) F s =reshape(O s ),F s ∈R (b×(c×h×w)) Among them, the Linear function is a learnable linear projection, which is implemented by a 1×1 convolution. The 1×1 convolution performs a weighted summation on the channels at each position of the feature map and finally converts it into a single-channel output. The Linear function can effectively retain feature information and align the convolution with the time series output features. The reshape function converts the time series output into an image-like output and calculates the feature difference to form a guidance function: L guide =||F c -F s || 2 。 10. The method according to claim 5, characterized in that Step S503: The main loss function generated by training is generated by CNN completing the detection and classification task. Its time series output is obtained during training to guide the task. cls It represents the cross entropy loss function generated by CNN's autonomous learning of local features when performing detection and classification tasks, that is, the main loss function. The difference between the extracted local information features and the global information features is added to the main loss function, so that CNN can learn the temporal characteristics of the data when updating the parameters. The final loss function in training consists of two parts: the main loss function and the guidance function of CNN: L=L cls -β·L guide Among them, the guidance parameter β is a hyperparameter set based on practical experience. The grid search algorithm is used to adjust the guidance parameter to ensure the best performance of the model in the mining traffic detection task.

Images